netdev - Re: [PATCH 1/1] neighbour: Fixed race condition at tbl->nht

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 21 Feb 2012 22:25:22 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Michel Machado <michel@...irati.com.br>
Cc:	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH 1/1] neighbour: Fixed race condition at tbl->nht

Le mardi 21 février 2012 à 16:04 -0500, Michel Machado a écrit :
> When the fixed race condition happens:
> 
> 1. While function neigh_periodic_work scans the neighbor hash table
> pointed by field tbl->nht, it unlocks and locks tbl->lock between
> buckets in order to call cond_resched.
> 
> 2. Assume that function neigh_periodic_work calls cond_resched, that is,
> the lock tbl->lock is available, and function neigh_hash_grow runs.
> 
> 3. Once function neigh_hash_grow finishes, and RCU calls
> neigh_hash_free_rcu, the original struct neigh_hash_table that function
> neigh_periodic_work was using doesn't exist anymore.
> 
> 4. Once back at neigh_periodic_work, whenever the old struct
> neigh_hash_table is accessed, things can go badly.
> 
> Signed-off-by: Michel Machado <michel@...irati.com.br>
> CC: "David S. Miller" <davem@...emloft.net>
> CC: Eric Dumazet <eric.dumazet@...il.com>
> ---
> 
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index e287346..2a83914 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -826,6 +826,8 @@ next_elt:
>  		write_unlock_bh(&tbl->lock);
>  		cond_resched();
>  		write_lock_bh(&tbl->lock);
> +		nht = rcu_dereference_protected(tbl->nht,
> +						lockdep_is_held(&tbl->lock));
>  	}
>  	/* Cycle through all hash buckets every base_reachable_time/2 ticks.
>  	 * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
> 

Nice catch !

Bug introduced in 2.6.37 in commit d6bf781712a (net neigh: RCU
conversion of neigh hash table)

Acked-by: Eric Dumazet <eric.dumazet@...il.com>




--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html